8.11.2.1.2 Permission Requirements When Enabling User Substitution

When you set privilege mode to either USER_IDENTICAL or USER_MAPPING, the following permission requirements must be met.

• Permission requirements for UBBCONFIG
  • The TUXCONFIG file *RESOURCE section SECURITY parameter must be USER_AUTH, ACL, or MANDATORY_ACL
  • *RESOURCES section AUTHSVC and SERVERS section AUTHSVR parameters must be set properly in accordance with USER_AUTH, ACL, or MANDATORY_ACL settings.
• Permission requirements for file system
  • The home directory access permission where JES is deployed should be granted to the user who initiates the deployment, and JES executor before the deployment.
  • App home may be created by Resource Broker during deployment if it does not exist. In this case, you need to configure App home directory with access permission for other group.
  • The$JES_BASE_DIR directory should be created before deployment and be readable/writable/executable for JES domain creator and all JES job executors.
• Permission Requirements for Creating, Configuring, and Booting JES Domain
  • Resource broker needs "root" permission to create, configure, or boot JES domain.
    • For the SHM domain, JES domain should be created, configured, or booted by root user.
    • For the MP domain, if JES servers are on a machine, the machine should be created, configured, or booted by root user.
    • If a machine is created, configured, or booted up by root user, tlisten on that machine must be booted by root user as well before deploying the Oracle Tuxedo domain using resource broker.
  • SUDO configurations must be made for performing activities with root user privileges.

    Resource broker needs "root" permission to create, configure, or boot JES domain.

From Oracle Enterprise Manager Cloud Control, click Setup > Security > Privilege Delegation. For more information, see Configuring Privilege Delegation Settings in Oracle Enterprise Manager Lifecycle Management Administrator's Guide.